This class provides access to the Windows event log on the remote machine.
Close the event log
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 178 def self.close(client, handle) request = Packet.create_request('stdapi_sys_eventlog_close') request.add_tlv(TLV_TYPE_EVENT_HANDLE, handle); response = client.send_request(request, nil) return nil end
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 65 def self.finalize(client,handle) proc { self.close(client,handle) } end
Initializes an instance of the eventlog manipulator.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 59 def initialize(hand) self.client = self.class.client self.handle = hand ObjectSpace.define_finalizer( self, self.class.finalize(self.client, self.handle) ) end
Opens the supplied event log.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 35 def EventLog.open(name) request = Packet.create_request('stdapi_sys_eventlog_open') request.add_tlv(TLV_TYPE_EVENT_SOURCENAME, name); response = client.send_request(request) return self.new(response.get_tlv_value(TLV_TYPE_EVENT_HANDLE)) end
the low level read function (takes flags, not hash, etc).
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 85 def _read(flags, offset = 0) request = Packet.create_request('stdapi_sys_eventlog_read') request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle) request.add_tlv(TLV_TYPE_EVENT_READFLAGS, flags) request.add_tlv(TLV_TYPE_EVENT_RECORDOFFSET, offset) response = client.send_request(request) EventLogSubsystem::EventRecord.new( response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER), response.get_tlv_value(TLV_TYPE_EVENT_TIMEGENERATED), response.get_tlv_value(TLV_TYPE_EVENT_TIMEWRITTEN), response.get_tlv_value(TLV_TYPE_EVENT_ID), response.get_tlv_value(TLV_TYPE_EVENT_TYPE), response.get_tlv_value(TLV_TYPE_EVENT_CATEGORY), response.get_tlv_values(TLV_TYPE_EVENT_STRING), response.get_tlv_value(TLV_TYPE_EVENT_DATA) ) end
Clear the specified event log (and return nil).
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 166 def clear request = Packet.create_request('stdapi_sys_eventlog_clear') request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle); response = client.send_request(request) return self end
Instance method
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 186 def close self.class.close(self.client, self.handle) end
Iterator for read_backwards.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 137 def each_backwards begin loop do yield(read_backwards) end rescue ::Exception end end
Iterator for read_forwards.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 117 def each_forwards begin loop do yield(read_forwards) end rescue ::Exception end end
Return the number of records in the event log.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 72 def length request = Packet.create_request('stdapi_sys_eventlog_numrecords') request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle); response = client.send_request(request) return response.get_tlv_value(TLV_TYPE_EVENT_NUMRECORDS) end
Return the record number of the oldest event (not necessarily 1).
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 149 def oldest request = Packet.create_request('stdapi_sys_eventlog_oldest') request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle); response = client.send_request(request) return response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER) end
Read the eventlog backwards, meaning from newest to oldest. Returns a EventRecord, and throws an exception after no more records.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 130 def read_backwards _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ) end
Read the eventlog forwards, meaning from oldest to newest. Returns a EventRecord, and throws an exception after no more records.
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 110 def read_forwards _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ) end
Generated with the Darkfish Rdoc Generator 2.